There’s No Hard Evidence That Law Enforcement is Actually “Going Dark”

In both hearings the witnesses representing law enforcement trotted out scary hypothetical situations and terrifying anecdotes about how encryption could stifle investigations and let “bad guys” go free. But when asked by Senators if they had any actual numbers on how often strong encryption thwarted investigations, neither Director Comey nor DAG Yates had any idea.

Both tried to duck the question by claiming that it was like “proving a negative.” But counting each time a law enforcement officer can’t access data because of encryption (or even just thinks they won’t be able to access data, without actually trying) doesn’t seem that difficult.1

The only actual number mentioned was from Manhattan District Attorney Vance, who said that his office had encountered locked iPhones 74 times. A spokesperson for his office told Wired that this was over 9 months, and that the office handles approximately 100,000 cases in the course of a year. This means the office encountered encryption in less than 0.1% of cases. That doesn’t sound like “going dark” is really a particularly pressing problem—especially since DA Vance didn’t bother to explain how any of the 74 encrypted iPhones that his office encountered actually stood in the way of a successful prosecution.

“A whole lot of good people have said it’s too hard … maybe that’s so,” he said to the Intelligence Committee. “But my reaction to that is: I’m not sure they’ve really tried.”

In a comment worthy of climate denialists, Comey told one senator: “Maybe the scientists are right. Ennnh, I’m not willing to give up on that yet.”

The new paper is the first in-depth technical analysis of government proposals by leading cryptographers and security thinkers, including Whitfield Diffie, a pioneer of public key cryptography, and Ronald L. Rivest, the “R” in the widely used RSA public cryptography algorithm. In the report, the group said any effort to give the government “exceptional access” to encrypted communications was technically unfeasible and would leave confidential data and critical infrastructure like banks and the power grid at risk.

im several years removed from being a yahoo (local, e.g. wasnt my primary concern) paranoid, but gratifying to see.

Kaspersky researchers have long eschewed the practice followed by many of their security research peers of attributing attacks to particular hacking groups or the sovereign nations that often support them. Wednesday’s report documenting the Duqu 2.0 attacks is no different.

[…]

“For a security company, one of the most difficult things is to admit falling victim to a malware attack,” Kaspersky researchers wrote in their report. “At Kaspersky Lab, we strongly believe in transparency, which is why we are publishing the information herein. For us, the security of our users remains the most important thing—and we will continue to work hard to regain your trust and confidence.”

Developers have published two pieces of malware that take the highly unusual step of completely running on an infected computer’s graphics card, rather than its CPU, to enhance their stealthiness and give them increased computational abilities.